© 2007 Cisco Systems, Inc. All rights reserved.Cisco Public ITE PC v4.0 Chapter 1 1 Basic Security Networking for Home and Small Businesses – Chapter 8

ITE PC v4.0 Chapter 1 2 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Objectives  Identify and describe the various networking threats.  Identify different methods of attack.  Describe security procedures and applications.  Describe the features of a firewall and how it can be used to protect against an attack.

ITE PC v4.0 Chapter 1 3 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Networking Threats  Describe major risks of network intrusion

ITE PC v4.0 Chapter 1 4 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Networking Threats  Define the sources of network intrusion.

ITE PC v4.0 Chapter 1 5 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Networking Threats  Describe social engineering and phishing

ITE PC v4.0 Chapter 1 6 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Methods of Attack  Viruses  a program that runs and spreads by modifying other programs or files  cannot start by itself; it needs to be activated  may do nothing more than replicate itself and spread  dangerous as it can quickly use all available memory and bring a system to a halt  Worms  similar to a virus  does not need to attach itself to an existing program  uses the network to send copies of itself to any connected hosts  Trojan horse  non-self replicating program that is written to appear like a legitimate program  it is an attack tool  deceive the victim into initiating the program

ITE PC v4.0 Chapter 1 7 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Methods of Attack

ITE PC v4.0 Chapter 1 8 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Methods of Attack  Denial of Service and Brute Force attacks

ITE PC v4.0 Chapter 1 9 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Methods of Attack  Denial of Service and Brute Force attacks DoS attacks seek to: Flood a system or network with traffic to prevent legitimate network traffic from flowing Disrupt connections between a client and server to prevent access to a service Two common DoS attacks are: SYN (synchronous) Flooding: a flood of packets are sent to a server requesting a client connection. The packets contain invalid source IP addresses. The server becomes occupied trying to respond to these fake requests and therefore cannot respond to legitimate ones. Ping of death: a packet that is greater in size than the maximum allowed by IP (65,535 bytes) is sent to a device. This can cause the receiving system to crash.

ITE PC v4.0 Chapter 1 10 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Methods of Attack  Denial of Service and Brute Force attacks Distributed Denial of Service (DDoS) designed to saturate and overwhelm network links with useless data hundreds or thousands of attack points attempt to overwhelm a target Brute Force a fast computer is used to try to guess passwords or decipher an encryption code

ITE PC v4.0 Chapter 1 11 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Methods of Attack  Describe spyware, tracking cookies, adware and pop- ups.

ITE PC v4.0 Chapter 1 12 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Methods of Attack  Describe spyware, tracking cookies, adware and pop- ups. Spyware any program that gathers personal information from your computer without your permission or knowledge installed unknowingly when downloading a file make changes to internal settings creating more vulnerabilities for other threats Tracking Cookies form of spyware used to record information about an Internet user when they visit websites may be useful or desirable many web sites require that cookies be enabled in order to allow the user to connect

ITE PC v4.0 Chapter 1 13 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Methods of Attack  Describe Spam

ITE PC v4.0 Chapter 1 14 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Security Procedures and Applications  Defining a security policy

ITE PC v4.0 Chapter 1 15 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Security Procedures and Applications  Define common security procedures

ITE PC v4.0 Chapter 1 16 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Security Procedures and Applications  Describe how updates and patches relate to security issues.

ITE PC v4.0 Chapter 1 17 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Security Procedures and Applications  Anti-virus software

ITE PC v4.0 Chapter 1 18 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Security Procedures and Applications Some of the signs that a virus, worm or Trojan horse may be present include:  Computer starts acting abnormally  Program does not respond to mouse and keystrokes  Programs starting or shutting down on their own  program begins sending out large quantities of  CPU usage is very high  There are unidentifiable, or a large number of processes running  Computer slows down significantly or crashes

ITE PC v4.0 Chapter 1 19 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Security Procedures and Applications  SPAM prevention

ITE PC v4.0 Chapter 1 20 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Security Procedures and Applications  Anti-Spyware

ITE PC v4.0 Chapter 1 21 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Other preventative actions to prevent the spread of spam include: Apply OS and application updates when available. Run an Antivirus program regularly and keep it up to date. Do not forward suspect s. Do not open attachments, especially from people you do not know. Set up rules in your to delete spam that by-pass the anti-spam software. Identify sources of spam and report it to a network administrator so it can be blocked. Report incidents to the governmental agency that deals with abuse by spam.

ITE PC v4.0 Chapter 1 22 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Firewall Features and How to Use them to Protect Against an Attack  What is a firewall?

ITE PC v4.0 Chapter 1 23 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Firewall Features and How to Use them to Protect Against an Attack  Using a Firewall to Protect Against an Attack

ITE PC v4.0 Chapter 1 24 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Firewall Features and How to Use them to Protect Against an Attack  Packet Filtering - Prevents or allows access based on IP or MAC addresses.  Application Filtering - Prevents or allows access to specific application types based on port numbers.  URL Filtering - Prevents or allows access to websites based on specific URLs or keywords.

ITE PC v4.0 Chapter 1 25 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Firewall Features and How to Use them to Protect Against an Attack  Stateful Packet Inspection (SPI) – Incoming packets must be legitimate responses to requests from internal hosts. Unsolicited packets are blocked unless permitted specifically. SPI can also include the capability to recognize and filter out specific types of attacks such as DoS.

ITE PC v4.0 Chapter 1 26 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Firewall Features and How to Use them to Protect Against an Attack  Vulnerability Analysis

ITE PC v4.0 Chapter 1 27 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Firewall Features and How to Use them to Protect Against an Attack  Security Best Practices There are several recommended practices to help mitigate the risks they pose, including:  Define security policies  Physically secure servers and network equipment  Set login and file access permissions  Update OS and applications  Change permissive default settings  Run anti-virus and anti-spyware  Update antivirus software files  Activate browser tools - Popup stoppers, anti-phishing, plug-in monitors  Use a firewall

ITE PC v4.0 Chapter 1 28 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public Summary  Networks can be open to intrusion through vulnerabilities in software, hardware attacks, or the weaknesses of individuals.  Effective network security is based on a variety of products and services, combined with a thorough security policy.  A firewall controls traffic between networks and helps prevent unauthorized access.

ITE PC v4.0 Chapter 1 29 © 2007 Cisco Systems, Inc. All rights reserved.Cisco Public